I’m thinking through how larger engineering teams should safely use coding agents.

Here’s the scenario:

An agent is updating one Java/Spring Boot service inside a larger enterprise platform.

My default instinct is that it should not get full monorepo access.

Provide it with the necessary service, related tests, and contracts it depends on, along with sufficient architectural context to avoid making incorrect assumptions.

However, I would not want to casually read unrelated packages, internal documents, secrets, credentials, or configuration that has nothing to do with the task.

That feels similar to how we already think about production services.

A service should not get access to every database just because it might need one table.

So my question is:

Where would you draw the boundary for coding agents?

Task-scoped access by default?

Full repo access with logging?

Human approval before expanding context?

Different rules for low-risk vs high-risk code?

Curious what others are seeing.